{
  "family": "peed",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nPeed (also widely known as the Storm Worm or Peacomm) was one of the most prolific and sophisticated botnets of the late 2000s. Originally appearing disguised as breaking news regarding a storm in Europe, Peed evolved into a massive, decentralized, peer-to-peer (P2P) botnet utilized by cybercriminals for massive spam distribution, Distributed Denial of Service (DDoS) attacks, and identity theft.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe primary infection vector for Peed is massive spam email campaigns. The emails use high-pressure, topical social engineering (news events, fake e-cards, or invoice notifications) to trick the user into opening a malicious attachment or clicking a link to a drive-by download site.\n\nOnce executed, Peed demonstrates advanced, highly resilient architecture:\n<ul>\n<li><strong>Peer-to-Peer (P2P) C2 Infrastructure:</strong> Unlike traditional botnets that relied on a central C2 server (which could be easily taken down by law enforcement), Peed utilizes a decentralized P2P protocol (often Overnet). Infected machines communicate directly with each other to receive commands and updates, making the botnet incredibly difficult to dismantle.</li>\n<li><strong>Aggressive Rootkit Evasion:</strong> Peed employs aggressive rootkit techniques (often utilizing `wincom32.sys`) to hide its files, registry keys, and active network connections from the user and traditional antivirus software. It actively attempts to disable local security services.</li>\n<li><strong>Monetization (Spam and DDoS):</strong> The primary function of an infected node is to silently send massive volumes of spam (often pump-and-dump stock scams or pharmaceutical ads) or to participate in coordinated DDoS attacks against specific targets for extortion.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the original Storm Worm botnet has largely been mitigated, the P2P and fast-flux DNS techniques it pioneered are still heavily utilized by modern malware. A Peed-style infection indicates a total compromise of the endpoint and places significant legal and reputational risk on the organization due to the machine's participation in global spam and DDoS operations.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Containment:</strong> Immediately isolate the infected machine from the network. Because the botnet relies on P2P communications, blocking standard P2P ports and monitoring for high volumes of outbound SMTP (Port 25) traffic is critical.</li>\n<li><strong>Rootkit Removal (Bare-Metal Restore):</strong> Because Peed utilizes kernel-level rootkits, manual removal is highly unreliable. The only secure remediation is to completely format the hard drive and reinstall the operating system from a trusted image.</li>\n<li><strong>Spam Blacklist Monitoring:</strong> If an infected machine successfully sent out spam, the organization's public IP address may be added to global DNS-based Blackhole Lists (DNSBLs), disrupting legitimate corporate email delivery.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Peacomm",
    "Worm.Storm",
    "Win32/Peed"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Peed and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Peed is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Peed establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Peed typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Peed compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Peed should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Trojan.Peacomm leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Trojan.Peacomm frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Trojan.Peacomm maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Trojan.Peacomm often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1090.002",
    "T1014",
    "T1498",
    "T1568"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "type": "Trojan / P2P Botnet",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "mitre_attack_detail": [
    {
      "id": "T1090.002",
      "name": "Connection Proxy: External Proxy (Abusing the tool for routing)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1014",
      "name": "Rootkit (Hiding files and processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Coordinated DDoS attacks)",
      "tactic": "Impact"
    },
    {
      "id": "T1568",
      "name": "Dynamic Resolution",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Enforce forensic network isolation on all suspected endpoints while maintaining an out-of-band telemetry conduit to capture live Peed adversary activity.",
    "Perform full memory dumps across identified staging nodes to extract memory-only implants, kernel rootkit hooks, and decrypted Peed C2 infrastructure IP/domain lists.",
    "Review Active Directory domain controller authentication logs for anomalous Kerberos ticket requests (Pass-the-Ticket, Golden Ticket) and unauthorized DCSync operations associated with Peed.",
    "Block all confirmed C2 domains, dynamic DNS endpoints, and proxy IP addresses across perimeter firewalls, proxies, and DNS security gateways.",
    "Conduct an enterprise-wide sweep across surrounding subnets for secondary webshells, WMI event subscriptions, or remote execution tooling left behind by Peed operators."
  ],
  "what_to_avoid": [
    "Do not assume the incident is resolved simply because an antivirus tool removed the initial Peed dropper; always verify that secondary payloads and persistence hooks have been eradicated.",
    "Avoid logging in with Domain Admin or privileged credentials on a machine suspected of running Peed until memory triage is complete.",
    "Do not delay host isolation; automated lateral movement and credential dumping can occur within minutes of initial execution."
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}